diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-03-26 17:11:23 +0100 |
|---|---|---|
| committer | Martin Kosek <mkosek@redhat.com> | 2014-04-11 10:17:41 +0200 |
| commit | a185d45d87539559876f7b0b4f75b904339a5b90 (patch) | |
| tree | 79fa64aca6cefceab54e137d74bb48a5d74157bd /ipalib/plugins/role.py | |
| parent | 50c7f3b2366aa48a966a958a7f95941c917ad3fa (diff) | |
| download | freeipa-a185d45d87539559876f7b0b4f75b904339a5b90.tar.gz freeipa-a185d45d87539559876f7b0b4f75b904339a5b90.tar.xz freeipa-a185d45d87539559876f7b0b4f75b904339a5b90.zip | |
Add managed read permissions to RBAC objects
Add default read permissions to roles, privileges and permissions.
Also add permission to read ACIs. This is required for legacy permissions.
Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
Diffstat (limited to 'ipalib/plugins/role.py')
| -rw-r--r-- | ipalib/plugins/role.py | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/ipalib/plugins/role.py b/ipalib/plugins/role.py index 2837c418b..04088b82a 100644 --- a/ipalib/plugins/role.py +++ b/ipalib/plugins/role.py @@ -66,6 +66,7 @@ class role(LDAPObject): object_name = _('role') object_name_plural = _('roles') object_class = ['groupofnames', 'nestedgroup'] + permission_filter_objectclasses = ['groupofnames'] default_attributes = ['cn', 'description', 'member', 'memberof', 'memberindirect', 'memberofindirect', ] @@ -77,6 +78,18 @@ class role(LDAPObject): 'member': ['privilege'], } rdn_is_primary_key = True + managed_permissions = { + 'System: Read Roles': { + 'replaces_global_anonymous_aci': True, + 'ipapermbindruletype': 'permission', + 'ipapermright': {'read', 'search', 'compare'}, + 'ipapermdefaultattr': { + 'businesscategory', 'cn', 'description', 'member', 'memberof', + 'o', 'objectclass', 'ou', 'owner', 'seealso', + }, + 'default_privileges': {'RBAC Readers'}, + }, + } label = _('Roles') label_singular = _('Role') |